CVE-2026-89691: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89691 Overview

CVE-2026-89691 is an out-of-bounds read vulnerability in the Linux kernel NFS server (nfsd) subsystem. The flaw resides in nfsd4_release_compoundargs(), which resets the args->ops pointer back to the inline iops[8] array after freeing a dynamically allocated ops buffer, but fails to reset args->opcnt. For NFSv4.1+ compounds, opcnt can reach up to 200. When the RPC status dump handler later reads up to 16 entries from args->ops[], it can read past the 8-element inline array into adjacent slab memory and leak the contents to userspace via netlink.

Critical Impact
A local, authenticated attacker can leak kernel slab memory contents through the netlink RPC status interface, potentially exposing sensitive kernel data.

Affected Products

Linux kernel nfsd subsystem (NFSv4.1+ compound handling)
Distributions shipping affected upstream kernel versions prior to the fix commits
Systems exporting NFS shares using the in-kernel NFS server

Discovery Timeline

2026-09-11 - CVE-2026-89691 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89691

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the NFSv4 compound argument release path. The function nfsd4_release_compoundargs() handles cleanup of compound RPC operation buffers. When the ops buffer was dynamically allocated because the compound exceeded the inline capacity, the release routine frees that buffer and resets args->ops to point back at the inline iops[8] array embedded in struct nfsd4_compoundargs.

The stale args->opcnt counter, however, retains the original operation count, which NFSv4.1+ permits up to 200. If rq_status_counter becomes stuck at an odd value, which occurs when nfsd_dispatch() hits an error path after marking the counter odd, the RPC status dump handler treats the request as active and iterates operations from args->ops[].

Because iops is the final field in the surrounding structure, indices 8 through 15 read directly into adjacent slab allocations. The dumper serializes the read contents through netlink to userspace, exposing kernel heap memory to any local process able to query the RPC status interface.

Root Cause

The root cause is a state inconsistency between two related fields. nfsd4_release_compoundargs() resets the ops pointer but leaves the count field describing the previously larger allocation. Any subsequent reader that trusts opcnt as the bound for iteration against the reset inline array walks past the end of iops[8].

Attack Vector

Exploitation requires local access to the NFS server host and the ability to query the netlink RPC status interface. An attacker triggers or waits for an nfsd_dispatch() error path that leaves rq_status_counter at an odd value while a large NFSv4.1+ compound is in flight. Reading the RPC status dump then returns up to eight slab-adjacent entries of leaked kernel memory. The vulnerability does not permit code execution or memory corruption, but repeated exposure can leak pointers, credentials, or other sensitive kernel data useful for chaining further attacks.

The fix, applied in upstream commits 58bcdfb, ae4c385, c1a4f7b, and e879148, unconditionally zeroes opcnt in nfsd4_release_compoundargs() so stale compound metadata is never exposed through the status interface. The change also removes the kvfree_rcu_mightsleep() sleep from the exposure window.

Detection Methods for CVE-2026-89691

Indicators of Compromise

Unexpected userspace processes opening netlink sockets to query RPC status on NFS server hosts.
nfsd error paths triggering elevated rates of odd rq_status_counter transitions in kernel logs.
Non-administrative local accounts repeatedly reading NFS RPC status information.

Detection Strategies

Audit kernel version and patch status on all hosts running the in-kernel NFS server.
Monitor for local processes that enumerate nfsd netlink RPC status when they have no operational reason to do so.
Correlate NFSv4.1+ compound activity with RPC dispatch error events that could induce the odd-counter state.

Monitoring Recommendations

Enable auditd rules covering netlink socket creation and reads targeting the RPC status family on NFS servers.
Ingest kernel logs and RPC subsystem telemetry into a centralized analytics platform for baseline deviation analysis.
Track process execution on NFS server hosts to identify unauthorized local users interacting with kernel status interfaces.

How to Mitigate CVE-2026-89691

Immediate Actions Required

Apply the upstream kernel patches or the vendor-provided update containing commits 58bcdfb2b2e4, ae4c38555e81, c1a4f7b1848f, and e879148867bd.
Inventory all hosts running the in-kernel NFS server and prioritize those with untrusted local users.
Restrict local shell access on NFS server hosts to trusted administrators only.

Patch Information

The fix zeroes opcnt unconditionally in nfsd4_release_compoundargs(). Reference the upstream commits: Kernel Git Commit 58bcdfb, Kernel Git Commit ae4c385, Kernel Git Commit c1a4f7b, and Kernel Git Commit e879148. Consult your distribution vendor for backported package availability.

Workarounds

Where patching is not immediately feasible, disable the in-kernel NFS server on hosts that do not require it.
Restrict netlink access to the RPC status interface using LSM policy or namespace isolation.
Limit local login rights on NFS server systems to reduce the pool of accounts capable of triggering the leak.

bash

# Verify running kernel version and confirm patched build is deployed
uname -r

# Temporarily disable the in-kernel NFS server if not required
systemctl stop nfs-server
systemctl disable nfs-server